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Via First Class Mail 

The Honorable Brian Frosh 
Attorney General 
Office of the Attorney General 
200 St. Paul Place 
Baltimore, MD 21202 


Re: Recent Sabre Hospitality Solutions Data Breach 


Dear Attorney General Frosh: 

I am writing to give you advance notice of a data privacy breach affecting employees of 
our firm, Jones Day. This breach involves an estimated 7 individuals residing in your State. 

On June 14, 2017, our travel services provider, Lawyers Travel Services, informed us 
that an unauthorized individual gained access to the travel reservation system of Sabre 
Hospitality Solutions (“Sabre”), a third party vendor for Lawyers Travel Services, between 
August 10, 2016 and March 9, 2017. Unfortunately, Sabre believes the unauthorized individual 
may have obtained access to certain personal information, including some of our employees’ 
names, addresses, credit or debit card numbers, and possibly payment card security access codes. 

Jones Day will notify the identified individuals this week. An exemplar copy of the 
notice letter is enclosed for your information. As the enclosed letter from Sabre explains, Sabre 
has taken steps to protect the security of its systems. We will be providing a full package of 
credit protection services and credit insurance for one year free of charge to the affected 
individuals. 

Should any significant new information arise, we will promptly inform you. In the 
meantime, please do not hesitate to contact me if I can provide you with any additional 
information. 



($12) 326-7889 
mpaez@jonesday.com 


Enclosure 


ALKHOBAR • AMSTERDAM • ATLANTA • BEIJING • BOSTON • BRISBANE • BRUSSELS * CHICAGO • CLEVELAND • COLUMBUS • DALLAS 
DETROIT * DUBAI • DOSSELDORF * FRANKFURT • HONG KONG • HOUSTON * IRVINE • JEDDAH * LONDON • LOS ANGELES 
MADRID • MEXICO CITY • MIAMI • MILAN • MOSCOW • MUNICH • NEW YORK • PARIS I PERTH • PITTSBURGH • RIYADH 
SAN DIEGO • SAN FRANCISCO • SAO PAULO • SHANGHAI • SILICON VALLEY • SINGAPORE ♦ SYDNEY • TAIPEI • TOKYO • WASHINGTON 






SABRE HOSPITALITY SOLUTIONS 


NOTICE OF DATA BREACH 


Dear Valued Customer: 

We are writing to you because of an incident involving unauthorized access to customer information associated 
with your hotel reservation(s). The privacy and protection of our customers’ information is a matter we take very 
seriously, and we recommend that you closely review the information provided in this letter for some steps that 
you may take to protect yourself against potential misuse of your information. 

What Happened? 

The Sabre Hospitality Solutions SynXis Central Reservations system (Hospitality CRS) facilitates the booking of 
hotel reservations made by consumers through hotels, online travel agencies, and similar booking services. 
Following an examination of forensic evidence, Sabre notified us on or about June 6, 2017 that an unauthorized 
party gained access to account credentials that permitted unauthorized access to unencrypted payment card 
information, as well as certain reservation information, for a subset of hotel reservations processed through the 
Hospitality CRS. 

The investigation determined that the unauthorized party first obtained access to payment card and other 
reservation information on August 10, 2016. The last access to payment card information was on March 9, 2017. 

What Information Was Involved? 

The unauthorized party was able to access payment card information for your hotel reservation(s), including 
cardholder name; card number; card expiration date; and, potentially, your card security code. The unauthorized 
party was also able, in some cases, to access certain information such as guest name, email, phone number, 
address, and other information. Information such as Social Security, passport, or driver’s license number was not 
accessed. 

What We Are Doing 

Sabre engaged a leading cybersecurity firm to support its investigation. Sabre also notified law enforcement and 
the payment card brands about this incident. 

What You Can Do 

You should remain vigilant for incidents of fraud and identity theft by regularly reviewing your account 
statements and monitoring free credit reports for any unauthorized activity. If you discover any suspicious or 
unusual activity on your accounts, be sure to report it immediately to your financial institutions, as major credit 
card companies have rules that restrict them from requiring you to pay for fraudulent charges that are timely 
reported. 

In addition, you may contact the Federal Trade Commission (FTC) or law enforcement, such as your state 
attorney general, to report incidents of identity theft or to learn about steps you can take to protect yourself from 
identity theft. You can contact the FTC at: 



You may contact the nationwide credit reporting agencies at: 


Equifax 

P.O. Box 105788 
Atlanta, GA 30348 
(800) 525-6285 

vvww.cuuilax.com 


Experian 
P.O. Box 9554 
Allen, TX 75013 
(888)397-3742 

www.cxperiun.com 


TransUnion 
P.O. Box 2000 
Chester, PA 19016 
(800)680-7289 

www.triuisLinion.com 


Please see the following page for certain state-specific information. 

For More Information 

We apologize for any inconvenience caused by this incident. If you have any questions regarding this incident or 
if you desire further information or assistance, please do not hesitate to contact us at [TELEPHONE NUMBER 
(toll-free, if available) OF PERSON OR BUSINESS REPORTING THE BREACH]. 


Sincerely, 

[SIGNATURE] 
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